Get a notification when a new device is detected on a FortiSwitch port

[Jannick]

Hi!

I'm looking to implement an automation in my FortiGate E100 in case on a specific port on my FortiSwitch 224E-POE a new MAC Address is detected.

The only problem I'm facing is, how to detect this properly?

I did some digging online and found out about sticky MAC addresses. I've enabled this for one specific port where always 1 specific device is connected to. I've setup the sticky MAC to persistently remember 1 address.

I managed to get a FortiSwitch notification about the detection of a new device (other than known in the remembered sticky MAC address) in the FortiSwitch Systems logs, but I cannot manage to get a notificaiton about it.

In the FortSwitch System Logs I did notice a new enterance, that looks like this:

Interface MAC learning limit exceeded, MAC 84:XX:59:XX:e9:XX on port11 (Packet VID: 1). - FortiSwitch system

So to just try out I made a Trigger in the Security Fabric Automations for notifications from the FortiSwitch system, like this:

FortiGate-100E (SYSTEM) # show
config system automation-trigger
edit "SYSTEM"
set event-type event-log
set logid 32699
next
end

and attached the trigger to a Stitch, but no matter what, it doesn't trigger.

(logid 32699 = FortiSwitch system)

My questions:

What is the best method for detecting a new device on a FortiSwitch port that normally always has the same device connected and triggering a Security Fabric Automation?

Why does my current trigger (when attached to a Stitch) no trigger an automation while being so broad?

Versions:
FortiGate: v.7.2.10

FortiSwitch: S224EP-v7.4.1-build0787

Thank you!

[Jannick]

I now managed to get a notification from the FortiSwitch system.

What I forgot to setup a 'Field Filter' on the message.

My trigger now looks like this

config system automation-trigger
edit "SYSTEM"
set event-type event-log
set logid 32699
config fields
edit 1
set name "msg"
set value "Interface MAC learning limit exceeded*"
next
end
next
end

The only question that still stands, is this the best way? I have the feeling there are better ways to detect a new device connecting to a port that always has the same device (with the same MAC address) connected to it.